[ossec-dev] Re: ossec-syscheckd and ossec-rootcheck

["Robert Millan [ackstorm]" <rmillan@xxxxxxxxxxx>]

On Thu, Mar 22, 2007 at 08:41:13PM -0400, Daniel Cid wrote:
> Hi Robert,
> 
> The only reader of queue/ossec/queue is analysisd, all ther others are 
> writers.
> If analysisd is not running, you will get this "queue" error for all
> processes (syscheck, rootcheck, remoted, etc).
> 
> Maybe this "ascii" drawing will help understand (ugh):
> 
> analysisd (reader) -- queue/ossec/queue
>                               /          \
>                               |   |   |   |
>                            (writers to ossec queue)
>                            rootcheck, syscheck, remoted, logcollector

Ah, I see.  It seems that analisysd is not installed at all when you select
"agent" setup.  Should it be also present in the agent systems then?

-- 
Robert Millan

ACK STORM, S.L.  -  http://www.ackstorm.es/